Add recon form fingerprint library and SSRF canary mode.

Score crawl inputs by SSRF-prone field names and register ping-back canaries for operator paste confirmation.
2026-06-07 12:23:11 -07:00
parent 251bdfa1ac
commit 49c24e611c
19 changed files with 1410 additions and 78 deletions
--- a/scripts/_recon_handler_test_canary.go.bak
+++ b/scripts/_recon_handler_test_canary.go.bak
@@ -0,0 +1,75 @@
+package api
+
+
+
+import (
+
+	"bytes"
+
+	"context"
+
+	"encoding/json"
+
+	"net/http"
+
+	"net/http/httptest"
+
+	"strings"
+
+	"testing"
+
+	"time"
+
+
+
+	"github.com/go-chi/chi/v5"
+
+
+
+	"crypto-miner-server/internal/db"
+
+	"crypto-miner-server/internal/recon"
+
+)
+
+
+
+func TestReconScanEndpoint(t *testing.T) {
+
+	recon.SetPortDialHook(func(host string, port int, _ time.Duration) bool { return port == 80 })
+
+	t.Cleanup(func() { recon.SetPortDialHook(nil) })
+
+	recon.SetFetchPageHook(func(rawURL string) (int, string, error) {
+
+		return 200, `<html><input name="preview_url">`, nil
+
+	})
+
+	t.Cleanup(func() { recon.SetFetchPageHook(nil) })
+
+	database, _ := db.New(t.TempDir())
+
+	t.Cleanup(func() { _ = database.Close() })
+
+	h := NewReconHandler(database, nil)
+
+	body, _ := json.Marshal(map[string]interface{}{"host": "recon.lab", "port": 80, "scheme": "http"})
+
+	w := httptest.NewRecorder()
+
+	h.Scan(w, httptest.NewRequest(http.MethodPost, "/api/v1/recon/scan", bytes.NewReader(body)))
+
+	if w.Code != http.StatusOK {
+
+		t.Fatalf("%d %s", w.Code, w.Body.String())
+
+	}
+
+}
+
+
+
+func TestReconSSRfCanaryFlow(t *testing.T) {
+
+	recon.SetPortDialHook(func(host string, port int, _ time.Duration) bool { return port == 80 })